CVE-2022-50135

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-50135
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix BUG: KASAN: null-ptr-deref in rxe_qp_do_cleanup The function rxe_create_qp calls rxe_qp_from_init. If some error occurs, the error handler of function rxe_qp_from_init will set both scq and rcq to NULL. Then rxe_create_qp calls rxe_put to handle qp. In the end, rxe_qp_do_cleanup is called by rxe_put. rxe_qp_do_cleanup directly accesses scq and rcq before checking them. This will cause null-ptr-deref error. The call graph is as below: rxe_create_qp { ... rxe_qp_from_init { ... err1: ... qp->rcq = NULL; <---rcq is set to NULL qp->scq = NULL; <---scq is set to NULL ... } qp_init: rxe_put{ ... rxe_qp_do_cleanup { ... atomic_dec(&qp->scq->num_wq); <--- scq is accessed ... atomic_dec(&qp->rcq->num_wq); <--- rcq is accessed } }

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/37da51efe6eaa0560f46803c8c436a48a2084da7 Patch
https://git.kernel.org/stable/c/8598b9d0a364c1663c96fc0fab9df0d36c809aea Patch
Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

18 Nov 2025, 18:08

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux
Linux linux Kernel
CWE CWE-476
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/37da51efe6eaa0560f46803c8c436a48a2084da7 - () https://git.kernel.org/stable/c/37da51efe6eaa0560f46803c8c436a48a2084da7 - Patch
References () https://git.kernel.org/stable/c/8598b9d0a364c1663c96fc0fab9df0d36c809aea - () https://git.kernel.org/stable/c/8598b9d0a364c1663c96fc0fab9df0d36c809aea - Patch
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: RDMA/rxe: Corrección BUG: KASAN: null-ptr-deref en rxe_qp_do_cleanup La función rxe_create_qp llama a rxe_qp_from_init. Si ocurre algún error, el controlador de errores de la función rxe_qp_from_init establecerá tanto scq como rcq en NULL. Luego, rxe_create_qp llama a rxe_put para manejar qp. Al final, rxe_put llama a rxe_qp_do_cleanup. rxe_qp_do_cleanup accede directamente a scq y rcq antes de verificarlos. Esto causará un error null-ptr-deref. El gráfico de llamadas es el siguiente: rxe_create_qp { ... rxe_qp_from_init { ... err1: ... qp-&gt;rcq = NULL; &lt;---rcq se establece en NULL qp-&gt;scq = NULL; &lt;---scq se establece en NULL ... } qp_init: rxe_put{ ... rxe_qp_do_cleanup { ... atomic_dec(&amp;qp-&gt;scq-&gt;num_wq); &lt;--- se accede a scq ... atomic_dec(&amp;qp-&gt;rcq-&gt;num_wq); &lt;--- se accede a rcq } }

18 Jun 2025, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-18 11:15

Updated : 2025-11-18 18:08

NVD link : CVE-2022-50135

Mitre link : CVE-2022-50135

CVE.ORG link : CVE-2022-50135

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference